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[DOCUMENT NAME] SPECIFICATION 

[TITLE OF THE INVENTION] RADIO NETWORK MONITOR DEVICE AND 
MONITOR SYSTEM 

[APPLICABLE FIELD IN THE INDUSTRY] 

5 [0001] 

The present invention relates to a monitor apparatus, 
a monitor system, a monitor method, and a monitor program 
of a wireless network, and more particularly, to a monitor 
apparatus, a monitor system, a monitor method, and a 
10 monitor program of a wireless network for managing a 
terminal . 
[BACKGROUND ART] 
[0002] 

As a first prior art for grasping a connection 
15 situation of a terminal with an AP, there exists the 

function installed into an AP management tool attached to 
an AP product (For example, non-patent document 1) . The 
above prior art provides the function that each AP 
collects information associated with the connection 
20 situation of the terminal, and supplies to the monitor 
apparatus connection information of the terminal in a 
unique format, which is text-displayed in a table format 
on a screen of the monitor apparatus (for example, a PC 
having a Web browser installed) . The so-called uniquely 
25 format includes, for example, information uniquely 
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specified by a vendor as MIB information (Management 
Information Base) of an SNMP (Simple Network Management 
Protocol), information uniquely specified by a vendor that 
is included in a HTTP (Hyper Text Transfer Protocol), a 
5 uniquely specified protocol, or the like. These formats, 
which are disclosed in some cases, are used only for its 
vendor 1 s appliances . 
[0003] 

As a second prior art, the technology that the monitor 
10 apparatus receives a broadcast packet of a wireless LAN, 
transmits a dummy packet to a transmission-source address 
of the same packet, and confirms its reply, thereby 
allowing a terminal-connection relation to be collected 
and to be displayed has been proposed (for example, patent 
15 document 1) . In this technology, the apparatus for 

monitoring a connection relation is installed network by 
network. 

[0004] 

Non-patent document 1: Cisco Systems Lnc, Association 
20 Table described in an Internet < 

http: //www2 . hipri . com/cisco_pdf /pdf search/displayPDF/OL_06 
57_08/0 657_08.PDF9-2> 

Patent document 1: JP-P1995-297852A 
[DISCLOSURE OF THE INVENTION] 
2 5 [PROBLEMS TO BE SOLVED BY THE INVENTION] 
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[0005] 

In the first prior art, employing information peculiar 
to an access point (AP) vendor necessitates AP application 
of the methods by vendors or the methods by appliances in 
5 order that the monitor apparatus copes with a large number 
of the APs of the vendor, which gives rise to the problem 
that its system becomes complicated and the cost of the 
monitor apparatus becomes high, or the problem the 
monitorable system is limited to a system having the 

10 specific vendor appliance employed. Further, in a case of 
employing information of its own format that has not been 
disclosed, it is difficult to collect information because 
the above information cannot be utilized in the first 
place . 

15 [0006] 

The second prior art typified by the patent document 1, 
which is capable of acquiring a connection relation of the 
terminal without depending upon the AP vendor, 
necessitates a configuration of the dedicated apparatus 

20 for directly transmitting/receiving the packet of the 
wireless LAN, which gives rise to the problem that the 
system becomes costly. Further, in order to collect 
information in a wide monitoring area, the above-mentioned 
dedicated transmission/reception apparatuses have to be 

25 installed into a large number of locations, which also 
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gives rise to a high cost. Further, with the wireless LAN, 
the packet is sometimes exchanged even between the 
appliance companions each of which belongs to the network 
different from that of the other, whereby there also 
5 exists the problem that a connection relation cannot be 
grasped accurately. 
[0007] 

Thereupon, the present invention has been accomplished 
in consideration of the above-mentioned problem, and an 
10 object thereof lies in solving the problem by providing a 
technology of realizing a function of grasping a 
connection relation between an AP and a terminal without 
necessitating information peculiar to an AP vendor and a 
large number of monitor apparatuses. 
15 [MEANS TO SOLVE THE PROBLEM] 
[0008] 

The first invention for solving the above-mentioned 
problem, which is a monitor apparatus of a wireless 
network, is characterized in including: a means connected 

20 to an access point of the wireless network via a network, 
which receives packet transfer information that the access 
point retains, and extracts an address of which a transfer 
destination is a wireless interface from the packet 
transfer information; and an estimating means for 

25 estimating that the terminal having the extracted address 
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exists as a subordinate of the access point retaining the 
packet transfer information. 
[0009] 

The second invention for solving the above-mentioned 
5 problem, which is a monitor apparatus of a wireless 

network, is characterized in including: a means connected 
to an access point of the wireless network via a network, 
which receives packet transfer information that the access 
point retains, and extracts an address of which a transfer 

10 destination is a wireless interface from the packet 
transfer information; and a determining means for 
investigating an operation situation of the terminal 
having the extracted address to determine that the 
terminal having the address has a connection with the 

15 access point retaining the packet transfer information in 
a case where the terminal having the address is in 
operation . 
[0010] 

The third invention for solving the above-mentioned 
20 problem is characterized in, in one of the above-mentioned 
first and second inventions, including: a managed terminal 
list having an address of a terminal, which is a target of 
management, registered; and a determining means for 
comparing the extracted address with an address described 
25 in the managed terminal list to determine that an access 
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to the access point retaining the packet transfer 
information has been made by a terminal that is not a 
target of management in a case where the extracted address 
is not included in the managed terminal list. 
5 [0011] 

The fourth invention for solving the above-mentioned 
problem is characterized in, in one of the above-mentioned 
first to third inventions, including a means for drawing a 
result on a relation between an access point and terminals, 

10 which are estimated to be existent as subordinates of the 
access point, or are determined to be in connection with 
the access point, for all the access points under 
management thereof to display an relation between each 
access point and each terminal that is estimated to be 

15 existent as a subordinate of each access point, or each 

terminal that is determined to be in connection with each 
access point. 
[0012] 

The fifth invention for solving the above-mentioned 
20 problem is characterized in, in one of the above-mentioned 
first to fourth inventions, in a case where the address of 
the identical terminal has been described in the packet 
transfer information retained by plural access points, 
including: a means for, from among the packet transfer 
25 information, selecting the packet transfer information 
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retained by the access point belonging to an identical 
subnet to that of the terminal, or the access point 
corresponding to a virtual LAN; and a means for, in a case 
where the selected packet transfer information retained by 
5 the access point belongs to the identical subnet to that 
of the terminal, and yet the number thereof is only one, 
estimating that the terminal exists as an subordinate of 
the one access point, or determines that the terminal has 
a connection with its access point, for, in a case where 

10 the access point belongs to the identical subnet to that 
of the terminal, and yet the number thereof is plural, 
estimating that the terminal exists as an subordinate of 
one of the plurality of the access points, or determining 
that the terminal has a connection with its access point, 

15 and for, in a case where all the access points do not 

belong to the identical subnet to that of the terminal, 
and yet each thereof is an access point corresponding to a 
virtual LAN, estimating that the terminal exists as an 
subordinate of one of the access points corresponding to 

20 the virtual LAN, or determining that the terminal has a 
connection with its access point. 
[0013] 

The sixth invention for solving the above-mentioned 
problem is characterized in, in one of the above-mentioned 
25 first to fifth inventions, in a case where the address of 
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the identical terminal has been described in the packet 
transfer information retained by plural access points, 
including: a means for, from the terminal, acquiring 
identification information of the wireless network to 
5 which the terminal belongs; a means for comparing 

identification information of the plural access points 
with the identification information acquired from the 
terminal; and a means for estimating that the terminal 
exists as a subordinate of the access point having the 
10 identification information identical to the identification 
information acquired from the terminal, or determining 
that the terminal has a connection with its access point. 
[0014] 

The seventh invention for solving the above-mentioned 
15 problem, which is a monitor system of a wireless network 
that is configured of at least one access point of the 
wireless network, at least one terminal of the wireless 
network, and a monitor apparatus connected to the access 
point via a network, is characterized in that the monitor 
20 apparatus includes: a means for receiving packet transfer 
information of the access point to extract an address of 
which a transfer destination is a wireless interface from 
the packet transfer information; and an estimating means 
for estimating that the terminal having the extracted 
25 address exists as a subordinate of the access point 



retaining the packet transfer information. 
[0015] 

The eighth invention for solving the above-mentioned 
problem, which is a monitor system of a wireless network 
that is configured of at least one access point of the 
wireless network, at least one terminal of the wireless 
network, and a monitor apparatus connected to the access 
point via a network, is characterized in that the monitor 
apparatus includes: a means for receiving packet transfer 
information of the access point to extract an address of 
which a transfer destination is a wireless interface from 
the packet transfer information; and a determining means 
for investigating an operation situation of the terminal 
having the extracted address to determine that the 
terminal having the address has a connection with the 
access point retaining the packet transfer information in 
a case where the terminal having the address is in 
operation. 

[0016] 

The ninth invention for solving the above-mentioned 
problem, is characterized in that, in one of the above- 
mentioned seventh and eighth inventions, the monitor 
apparatus includes: a managed terminal list having an 
address of a terminal, which is a target of management, 
registered; and a determining means for comparing the 
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extracted address with an address described in the managed 
terminal list to determine that an access to the access 
point retaining the packet transfer information has been 
made by a terminal that is not a target of management in a 
5 case where the extracted address is not included in the 
managed terminal list. 
[0017] 

The tenth invention for solving the above-mentioned 
problem is characterized in that, in one of the above- 

10 mentioned seventh to ninth inventions, the monitor 

apparatus includes a means for drawing a result on a 
relation between an access point and terminals, which are 
estimated to be existent as subordinates thereof, or are 
determined to be in connection with the access point, for 

15 all the access points under management thereof to display 
a relation between each access point and each terminal 
that is estimated to be existent as a subordinate of each 
access point, or each terminal that is determined to be in 
connection with each access point. 

20 [0018] 

The eleventh invention for solving the above-mentioned 
problem is characterized in that, in one of the above- 
mentioned seventh to tenth inventions, in a case where the 
address of the identical terminal has been described in 

25 the packet transfer information retained by plural access 
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points, the monitor apparatus includes: a means for, from 
among the packet transfer information, selecting the 
packet transfer information retained by the access point 
belonging to an identical subnet to that of the terminal, 
5 or the access point corresponding to a virtual LAN; and a 
means for, in a case where the selected packet transfer 
information retained by the access point belongs to the 
identical subnet to that of the terminal, and yet the 
number thereof is only one, estimating that the terminal 

10 exists as an subordinate of the one access point, or 

determining that the terminal has a connection with its 
access point, for, in a case where the access point 
belongs to the identical subnet to that of the terminal, 
and yet the number thereof is plural, estimating that the 

15 terminal exists as an subordinate of one of the plurality 
of the access points, or determining that the terminal has 
a connection with its access point, and for, in a case 
where all the access points do not belong to the identical 
subnet to that of the terminal, and yet each thereof is an 

20 access point corresponding to a virtual LAN, estimating 
that the terminal exists as an subordinate of one of the 
access points corresponding to the virtual LAN, or 
determining that the terminal has a connection with its 
access point. 

25 [0019] 
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The twelfth invention for solving the above-mentioned 
problem is characterized in that, in one of the above- 
mentioned seventh to eleventh inventions, in a case where 
the address of the identical terminal has been described 
in the packet transfer information retained by plural 
access points, the monitor apparatus includes: a means for, 
from the terminal, acquiring identification information of 
the wireless network to which the terminal belongs; a 
means for comparing identification information of the 
plural access points with the identification information 
acquired from the terminal; and a means for estimating 
that the terminal exists as a subordinate of the access 
point having identification information identical to the 
identification information acquired from the terminal, or 
determining that the terminal has a connection with its 
access point . 

[0020] 

The thirteenth invention for solving the above- 
mentioned problem is characterized in that, in one of the 
above-mentioned seventh to twelfth inventions; the 
terminal includes a means for transmitting a broadcast 
packet; and the access point includes a means for updating 
the packet transfer information that the access point 
retains based upon the broadcast packet. 

[0021] 



The fourteenth invention for solving the above- 
mentioned problem is characterized in, in one of the 
above-mentioned seventh to thirteenth inventions, the' 
access point includes: a means for notifying to the other 
access point information as to which access point to which 
the terminal belongs; and a means for updating the packet 
transfer information that the access point retains based 
upon the information as to which access point to which the 
terminal belongs . 

[0022] 

The fifteenth invention for solving the above- 
mentioned problem, which is a control program of an 
information processing apparatus that is connected to an 
access point of a wireless network via a network, and 
employed as a monitor apparatus, is characterized in that 
the control program causes the information processing 
apparatus to function as: a means for receiving packet 
transfer information of the access point to extract an 
address of which a transfer destination is a wireless 
interface from the packet transfer information; and an 
estimating means for estimating that the terminal having 
the extracted address exists as a subordinate of the 
access point retaining the packet transfer information. 

[0023] 

The sixteenth invention for solving the above- 



mentioned problem, which is a control program of an 
information processing apparatus that is connected to an 
access point of a wireless network via a network, and 
employed as a monitor apparatus, is characterized in that 
the control program causes the information processing 
apparatus to function as: a means for receiving packet 
transfer information of the access point to extract an 
address of which a transfer destination is a wireless 
interface from the packet transfer information; and a 
determining means for investigating an operation situation 
of the terminal having the extracted address to determines 
that the terminal having the address has a connection with 
the access point retaining the packet transfer information 
in a case where the terminal having the address is in 
operation. 
[0024] 

The seventeenth invention for solving the above- 
mentioned problem is characterized in that, in one of the 
above-mentioned fifteenth and sixteenth inventions, the 
control program causes the information processing 
apparatus to function as a determining means for comparing 
the extracted address with an address described in a 
managed terminal list having an address of a terminal, 
which is a target of management, registered to determine 
that an access to the access point having the packet 
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transfer information has been made by a terminal that is 
not a target of management in a case where the extracted 
address is not included in the managed terminal list. 
[0025] 

The eighteenth invention for solving the above- 
mentioned problem is characterized in that, in one of the 
above-mentioned fifteenth to seventeenth inventions, the 
control program causes the information processing 
apparatus to function as a means for drawing a result on a 
relation between an access point and terminals, which are 
estimated to be existent as subordinates of the access 
point, or are determined to be in connection with the 
access point, for all access points under management 
thereof to display a relation between each access point 
and each terminal that is estimated to be existent as a 
subordinate of each access point, or each terminal that is 
determined to be in connection with each access point. 

[0026] 

The nineteenth invention for solving the above- 
mentioned problem is characterized in that, in one of the 
above-mentioned fifteenth to eighteenth inventions, in a 
case where the address of the identical terminal has been 
described in the packet transfer information retained by 
plural access points, the control program causes the 
information processing apparatus to function as: a means 
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for, from among the packet transfer information, selecting 
the packet transfer information retained by the access 
point belonging to the identical subnet to that of the 
terminal, or the access point corresponding to a virtual 
5 LAN; and a means for, in a case where the selected packet 
transfer information retained by the access point belongs 
to the identical subnet to that of the terminal, and yet 
the number thereof is only one, estimating that the 
terminal exists as an subordinate of the one access point, 

10 or determining that the terminal has a connection with its 
access point, for, in a case where the access point 
belongs to the identical subnet to that of the terminal, 
and yet the number thereof is plural, estimating that the 
terminal exists as an subordinate of one of the plurality 

15 of the access points, or determining that the terminal has 
a connection with its access point, and for, in a case 
where all the access points do not belong to the identical 
subnet to that of the terminal, and yet each thereof is an 
access point corresponding to a virtual LAN, estimating 

20 that the terminal exists as an subordinate of one of the 
access points corresponding to the virtual LAN, or 
determining that the terminal has a connection with its 
access point . 
[0027] 

25 The twentieth invention for solving the above- 
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mentioned problem is characterized in that, in one of the 
above-mentioned fifteenth to nineteenth inventions, in a 
case where the address of the identical terminal has been 
described in the packet transfer information retained by 
5 plural access points, the control program causes the 

information processing apparatus to function as: a means 
for, from the terminal, acquiring identification 
information of the wireless network to which the terminal 
belongs; a means for comparing identification information 

10 of the plural access points with the identification 

information acquired from the terminal; and a means for 
estimating that the terminal exists as a subordinate of 
the access point having identification information 
identical to the identification information acquired from 

15 the terminal, or determining that the terminal has a 
connection with its access point. 
[0028] 

The twenty-first invention for solving the above- 
mentioned problem, which is a monitor method of a wireless 

20 network for managing a terminal, is characterized in 

including the steps of: extracting an address of which a 
transfer destination is a wireless interface from packet 
transfer information that an access point of the wireless 
network retains; and estimating that the terminal having 

25 the extracted address exists as a subordinate of the 
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access point retaining the packet transfer information. 
[0029] 

The twenty-second invention for solving the above- 
mentioned problem, which is a monitor method of a wireless 
5 network for managing a terminal, is characterized in 

including the steps of: extracting an address of which a 
transfer destination is a wireless interface from packet 
transfer information that an access point of the wireless 
network retains; and investigating an operation situation 

10 of the terminal having the extracted address to determine 
that the terminal having the address has a connection with 
the access point retaining the packet transfer information 
in a case where the terminal having the address is in 
operation . 

15 [0030] 

The twenty-third invention for solving the above- 
mentioned problem is characterized in, in one of the 
above-mentioned twenty-first and twenty-second inventions, 
including a step of comparing the extracted address with 

20 an address described in a managed terminal list having an 
address of a terminal, which is a target of management, 
registered to determine that an access to the access point 
having the packet transfer information has been made by a 
terminal that is not a target of management in a case 

25 where the extracted address is not included in the managed 



terminal list. 
[0031] 

The twenty-fourth invention for solving the above- 
mentioned problem, is characterized in, in one of the 
above-mentioned twenty-first to twenty-third inventions, 
including a step of drawing a result on a relation between 
an access point and terminals, which are estimated to be 
existent as subordinates of the access point, or are 
determined to be in connection with the access point, for 
all access points under management thereof to display an 
relation between each access point and each terminal that 
is estimated to be existent as a subordinate of each 
access point, or each terminal that is determined to be in 
connection with each access point. 

[0032] 

The twenty-fifth invention for solving the above- 
mentioned problem, is characterized in, in one of the 
above-mentioned twenty-first to twenty-fourth inventions, 
in a case where the address of the identical terminal has 
been described in the packet transfer information retained 
by plural access points, including: a step of: from among 
the packet transfer information, selecting the packet 
transfer information retained by the access point 
belonging to the identical subnet to that of the terminal, 
or the access point corresponding to a virtual LAN; and a 



- 20 - 



step of, in a case where the selected packet transfer 
information retained by the access point belongs to the 
identical subnet to that of the terminal, and yet the 
number thereof is only one, estimating that the terminal 
5 exists as an subordinate of the one access point, or 

determining that the terminal has a connection with its 
access point, of, in a case where the access point belongs 
to the identical subnet to that of the terminal, and yet 
the number thereof is plural, estimating that the terminal 

10 exists as an subordinate of one of the plurality of the 
access points, or determining that the terminal has a 
connection with its access point, and of, in a case where 
all the access points do not belong to the identical 
subnet to that of the terminal, and yet each thereof is an 

15 access point corresponding to a virtual LAN, estimating 
that the terminal exists as an subordinate of one of the 
access points corresponding to the virtual LAN, or 
determining that the terminal has a connection with its 
access point. 

20 [0033] 

The twenty-sixth invention for solving the above- 
mentioned problem, is characterized in, in one of the 
above-mentioned twenty-first to twenty-fifth inventions, 
in a case where the address of the identical terminal has 

25 been described in the packet transfer information retained 
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by plural access points, including: a step of, from the 
terminal, acquiring identification information of the 
wireless network to which the terminal belongs; a step of 
comparing identification information of the plural access 
5 points with the identification information acquired from 
the terminal; and a step of estimating that the terminal 
exists as a subordinate of the access point having the 
identification information identical to the identification 
information acquired from the terminal, or determining 
10 that the terminal has a connection with its access point. 
[0034] 

An operation of the present invention will be 
described. The present invention is for, based upon 
wireless interface information to be included in the 

15 packet transfer information that the access point has, 
extracting an address of the terminal that is connected 
via the wireless interface to estimate that the terminal 
having this address exists a subordinate of the access 
point. In such a manner, the packet transfer information 

20 that a general access point has is employed to estimate 
the terminal, being a subordinate of the access point, 
thereby making it possible to estimate existence of the 
terminal, being a subordinate of the access point, without 
depending upon a vendor. 

25 [0035] 
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Further, in the present invention, confirming the 
operation situation of the above-mentioned terminal of 
which existence has been estimated enables a connection 
relation between the access point and the terminal to be 
5 determined . 

[EFFECTS OF THE INVENTION] 
[0036] 

The present invention exhibits an excellent effect 
that, in the monitor apparatus, the address of which the 

10 transfer destination is a wireless interface is extracted 
from the transfer information that the access point 
retains for a purpose of transferring and it is estimated 
that the terminal having this extracted address exists as 
a subordinate of the access point retaining the packet 

15 transfer information, whereby a connection relation 

between the AP and the terminal of the wireless LAN can be 
grasped without depending upon the vendor and further 
without necessitating a large of the monitor apparatuses, 
[0037] 

20 Further, the present invention does not necessitate 

installation of a plurality of the apparatuses because 
information of all APs under management can be collected 
by one apparatus network-connected to the above AP. 
[0038] 

25 Further, grasping a connection relation between the AP 
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and the terminal allows the effect that the wireless LAN 
can be operated/managed smoothly to be obtained. 
[0039] 

Yet further, the effect that it becomes possible to 
appropriately take a load distribution control is obtained 
because the precision at which the load to each AP is 
estimated is enhanced. 

[0040] 

Yet further, by detecting the terminal that is not an 
object of registration, the effect that an unjust access 
can be detected is obtained. 
[BRIEF DESCRIPTION OF THE DRAWINGS] 

[0041] 

[Fig. 1] Fig. 1 is a configuration view illustrating a 
configuration of an embodiment 1 and an embodiment 2 of 
the present invention. 

[Fig. 2] Fig. 2 is a process flowchart in the 
embodiment 1 and the embodiment 2 of the present invention. 

[Fig. 3] Fig. 3 is a view illustrating an example of 
information to be recorded in a recorder 1013, which is 
used in the embodiment 1 and the embodiment 2 of the 
present invention. 

[Fig. 4] Fig. 4 is a process flowchart of making a 
selection by a subnet to which the terminal belongs in a 
case where the record of the terminal has been repeated in 



an embodiment 3 of the present invention. 

[Fig. 5] Fig. 5 is a view illustrating an example of 
information to be recorded in the recorder 1013, which is 
used in the embodiment 3 of the present invention. 

[Fig. 6] Fig. 6 is a process flowchart of making a 
selection by an AP group identifier that is acquired from 
the terminal in a case where the record of the terminal 
has been repeated in the embodiment 3 of the present 
invention . 

[Fig. 7] Fig. 7 is a view illustrating an example of 
information to be recorded in the recorder 1013, which is 
used in the embodiment 3 of the present invention. 

[Fig. 8] Fig. 8 is a view illustrating an example of a 
display format in the embodiment of the present invention. 

[Fig. 9] Fig. 9 is a view illustrating an example of a 
display format in the embodiment of the present invention. 

[Fig. 10] Fig. 10 is a block configuration diagram in 
an embodiment 4 of the present invention. 
[DESCRIPTION OF NUMERALS] 

[0042] 

101 monitor apparatus 

103 to 107 wireless LAN terminals 

110 to 112 wireless LAN access points (APs) 

1011 transmission/reception section 

1012 analyzer 
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1013 recorder 

1014 display 

1015 managed terminal list 

[BEST MODE FOR CARRYING OUT THE INVENTION] 

5 [0043] 

In the present invention, a monitor apparatus 
(equivalent to 101 of Fig. 1) connected to the access 
point of the wireless network via a network extracts the 
address of the terminal that is connected via a wireless 

10 interface based upon wireless interface information to be 
included in packet transfer information (equivalent to 120 
of Fig. 1) that the access point has, and estimates that 
the address having this address exists as a subordinate of 
the access point 

15 [0044] 

Further, by investigating the operation situation of 
the terminal that is estimated to be existent as a 
subordinate of the access point with the above-mentioned 
technique, it is determined that the above terminal has a 

20 connection with its access point. As one example of the 
method of investigating this operation situation, there 
exists the method of confirming a response of an ICMP 
packet (in general, a ping command) . This confirmation can 
be made in an analyzer 1012 and a transmission/reception 

25 section 1011 of Fig. 1. 



[0045] 

Additionally, the present invention enables 
information associated with the packet transfer of the 
access point, which is, as a rule, information that is 
retained irrespectively of an apparatus vendor, to be 
processed without depending upon the vendor. 

[0046] 

Further, the present invention is configured so that 
the monitor apparatus, which is provided with a managed 
terminal list (equivalent to 1015 of Fig. 1) having the 
address of the terminal, which is a target of management, 
pre-registered, compares the above-mentioned extracted 
address with the address described in the managed terminal 
list to monitor an access to the access point retaining 
the packet transfer information by the terminal that is 
not a target of management, i.e. an unjust access in a 
case where the extracted address is not included in the 
managed terminal list. 

[0047] 

Further, the present invention is configured so as to 
draw a conclusion on a relation with the terminal, which 
is estimated to be existent as a subordinate of each 
access point, or the terminal, which is determined to be 
in connection with each access point, for all the access 
points under management and to display these relations. 



[0048] 

Further, the present invention is configured so that, 
in a case where the address of the identical terminal has 
been described in a plurality of access points having the 
packet transfer information, the access point that does 
not belong to the identical subnet to that of the terminal, 
out of a plurality of the. access points, is excluded, and 
in a case where the number of the access point belonging 
to the identical subnet to that of the terminal becomes 
one (1) as a result of exclusion, it is estimated that the 
terminal exists as a subordinate of one access point, or 
it is determined that the terminal has a connection with 
its access point. 

[0049] 

Yet further, as another technique in the case that the 
address of the identical terminal has been described in a 
plurality of access points having the packet transfer 
information, a configuration is made so that the 
identification information of the wireless network to 
which the terminal belongs is acquired from the terminal, 
this identification information is compared with the 
identification information of a plurality of the access 
points, and thereby, it is estimated that the terminal 
exists as a subordinate of the access point having the 
identical identification information to the identification 
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information acquired from the terminal, or it is 
determined that the terminal has a connection with its 
access point. 
[0050] 

5 Hereinafter, specific embodiments will be explained. 

[Embodiment: 1] 

[0051] 

An embodiment 1 of the present invention will be 
explained in details based upon the accompanied drawings. 
10 [0052] 

Fig. 1 illustrates an example of the monitor system of 
the wireless LAN by the monitor apparatus of the present 
invention. 

[0053] 

15 The monitor system of the wireless LAN in the 

embodiment 1 of the present invention is configured of one 
wireless LAN access point (AP) or more 110 to 112 having 
the packet transfer information, wireless LAN terminals 
103 to 107 of which the number is zero, or at least one, 

20 and a monitor apparatus 101 connected the AP via a network. 
Additionally, the monitor apparatus 101 may be an 
independent apparatus, and may be installed within the 
access point (AP) or the terminal, or within a switch of 
Layer 2 or Layer 3 connected to the access point (AP) . 

25 [0054] 



The packet transfer information that the access point 
retains is, for example, packet transfer information 120 
as shown in Fig. 1. in this figure, the packet transfer 
information that an AP 3 has is shown, in which a 
correspondence table of an interface and a port, a 
transfer destination address table, and a transfer 
destination port table are kept. This information, which 
is information that a bridge or a router retains normally, 
is generally kept in the AP as well. The packet transfer 
information can be acquired by employing the SNMP. 

[0055] 

The monitor apparatus 101 is configured of a 
transmission/reception section 1011 for making 
communication with the AP, a analyzer 1012 for analyzing 
information received from the AP, a managed terminal list 
1015 for retaining a list of the terminal, being a target 
of management, a recorder 1013 for retaining a connection 
relation between the derived AP and the terminal, and a 
display 1014 for displaying a connection relation between 
the AP and the terminal. Additionally, it is acceptable 
that the display 1014 is not integrated into the monitor 
apparatus 101, but may be mounted over a network, thereby 
allowing the connection relation to be displayed with the 
network connection. 

[0056] 



An operation of the embodiment 1 of the present 
invention will be explained by employing Fig. 1 and Fig. 2 
having the process-flow shown. 

[0057] 

The monitor apparatus 101 grasps a connection relation 
with the terminal for each AP under management thereof, 
and displays its result in the display 1014. For this end, 
the monitor apparatus 101 performs a process for grasping 
a connection relation with the terminal one AP by one AP 
(steps SI to Sll) . Herein, an explanation will be made 
along the example of grasping a connection relation with 
the terminal of the AP 3 of Fig. 1 as a specific example. 

[0058] 

In the step S2, the analyzer 1012 and the 
transmission/reception section 1011 of the monitor 
apparatus 101 grasp an interface number (for example, an 
ifindex value in the MIB information of the SNMP) assigned 
to the wireless LAN interface of the above AP. In the 
product of the AP, the ifindex value in the MIB 
information, which is a fixed value as a rule, may be 
defined in advance according to the kind of the AP, and 
information of all the interface numbers provided may be 
acquired and judged by employing the SNMP etc. 

[0059] 

In the step S3, the transmission/reception section 
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1011 of the monitor apparatus 101 acquires interface/port 
correspondence information out of information associated 
with the packet transfer from the AP, and supplies it to 
the analyzer 1012. The relation of the interface number vs. 
5 the port number is a relation of 1 vs. 1 or 1 vs . many. 
This information makes it possible to judge which port 
number is equivalent to the wireless LAN interface. In an 
example of the AP3, it is seen from the correspondence 
table of the interface and the port number that a wireless 
10 LAN interface 1 has been assigned to a port 2. 
[0060] 

In the step S4, the transmission/reception section 
1011 of the monitor apparatus 101 receives the transfer 
destination port table and the transfer destination 
15 address table of the AP out of information associated with 
the packet transfer from the AP, and delivers them to the 
analyzer 1012. 
[0061] 

The analyzer 1012 extracts an entry of which the 
20 transfer destination port is the port of the wireless LAN 
interface, and records the transfer destination address of 
the identical entry as a terminal address in the recorder 
1013. Fig. 3 shows an example of information that is 
recorded in the recorder 1013. At this time point, the 
25 corresponding AP, the extracted entry, and the address 
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corresponding to its entry are described. In an example of 
the AP3, the wireless LAN interface is the port 2, which 
corresponds to an entry B and an entry C, by making a 
reference to the transfer destination port table, and it 
5 is seen from the transfer destination address table that 
the transfer destination address of these entries are an 
address E and an address Y respectively. In the recorder 
1013, as shown in Fig. 3, the address E and the address Y 
are described as the entry B of the AP3 and the entry C of 

10 the AP 3, respectively. Utilizing the packet transfer 

information that the AP retains in such a manner makes it 
possible to recognize the address of the terminal 
connected to the wireless LAN interface without depending 
upon the vendor, and to recognize the address of the 

15 terminal that is estimated to be existent as a subordinate 
of the access point (in this example, it can be estimated 
that the terminal having the address E and the terminal 
having the address Y exist as a subordinated of the AP3 
respectively) . Further, the record that the packet passed 

20 is left in the transfer information of the AP regardless 
of success or failure in authentication for making a 
connection with the wireless LAN by the terminal, whereby 
information associated with the terminal that has not 
succeeded in authentication also can be acquired. 

25 [Embodiment 2] 
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[0062] 

In the embodiment 2, the operation proceeds to a point 
of determining whether or not the terminal estimated to be 
existent as a subordinate of the access point with the 
technique described in the embodiment 1 has a connection 
with its access point. 

[0063] 

In the network configuration of Fig. 1, the operation 
of the embodiment 2 is identical to that of the embodiment 
1 until the point of estimating the terminal that exits as 
a subordinate of the access point in the steps SI to S4 of 
Fig. 2. 

[0064] 

In the embodiment 2, thereafter, the steps S5 to S10 
of Fig. 2 are taken for each recorded transfer destination 
address. The address of the terminal that is a target of 
management is pre-registered into the managed terminal 
list 1015. As an example of the address to be included in 
the managed terminal list 1015, there exists an MAC 
address or an IP address. 

[0065] 

In the step S6, the analyzer 1012 confirms whether the 
terminal address recorded in the recorder 1013 is 
described in the list of the address of the registered 
terminal. In a case where there is no description about it 
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in the list, it is judged that the terminal that is not a 
target of management has accessed the above AP (step S7) . 
Upon assuming that the terminal having the above address 
has made an unjust access, accompanied by this judgment, a 
5 warning may be issued. In an example of the AP3, there is 
no description of the address Y, being one of the 
addresses acquired in the step S4, in the managed terminal 
list, so the terminal having the above address is regarded 
as a terminal that is not a target of management. 

10 [0066] 

In a case of the terminal address of which description 
exists in the list, the operation proceeds to the step S8, 
where the operation situation of the terminal having the 
above address is investigated. The reason is that there is 
15 the possibility that the terminal, which has already 

stopped the operation as a matter of fact, exists even 
though there is the description in the table of the AP. 
[0067] 

As a method of investigating the operation situation, 
20 there exists the method that the analyzer 1012 of the 
monitor apparatus 101 transmits the ICMP packet (in 
general, ping command) via the transmission/reception 
section 1011 to confirm its response. In a case where it 
has been judged that the terminal is not operating, the 
25 effect that the appliance having the above transfer 
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destination address is in non-operation is recorded in the 
recorder 1013. In a case where it has been judged that the 
terminal is operating, the effect that it is in operation 
is recorded in the recorder 1013. As a result of this, it 
can be determined that the terminal of which the operation 
recorded in the recorder 1013 has been confirmed has a 
connection with the AP described in the above record. 
[0068] 

In an example of the AP3, the process for confirming 
the operation situation for the address E is performed, 
and when the operation is confirmed, it can be judged that 
the terminal having the address E, i.e. a terminal 5 has a 
connection with the AP3. These processes are performed 
repeatedly for each recorded transfer destination address 
and for each AP, thereby to extract the address of the 
terminal, and to record the operation situation of the 
terminal . 

[0069] 

Additionally, in a case where the packet transfer 
information of the AP has not been updated appropriately, 
information such that the identical terminal belongs to 
the different APs simultaneously is sometimes recorded in 
the recorder 1013. That is, in some cases, it follows that 
the identical terminal is recorded repeatedly in both of 
the AP to which it belonged previously and the AP to which 
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it belongs currently. Even in this case, when the terminal 
transmits the broadcast packet via the AP to which the 
terminal newly belongs, and the AP to which the terminal 
previously belonged receives the packet of the above 
terminal from the port in the wire side, the packet 
transfer information is updated, and the repeated record 
disappears. As a typical example of the broadcast packet 
is listed the ARP (Address Resolution Protocol, being a 
protocol to be employed for taking the correspondence 
between the physical address and the IP address) packet 
that is transmitted prior to communication. 
[0070] 

Further, employing the AP having the function 
installed such that the AP notifies information of the 
terminal, which has newly made a connection, to the other 
AP also makes it possible to update the packet transfer 
information (for example, the function of employing the 
Inter Access Point Protocol in the IEEE standard 802.11, 
thereby to notify a travel of the terminal) . 
[0071] 

In such a manner, a connection relation between the 
terminal, of which the operation has been confirmed, and a 
specific AP is recorded in the recorder 1013. 

[0072] 

With a relation between the terminal, which is in 
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operation according to the recorder 1013, and the AP 
described in its line, the display 1014 displays the 
terminals having a connection with the AP in a tree shape 
AP by AP, as shown in the screen display 102 of Fig. 1. 
Displaying a plurality of the APs under management and the 
terminals as a subordinate thereof simultaneously in a 
tree shape enables an administrator of the wireless LAN to 
easily recognize a connection relation between the AP and 
the terminal. Additionally, as a display format to be used 
in displaying a connection relation between the AP and the 
terminal, in addition to the example shown in the screen 
display 102 of Fig. 1, a tree format shown in Fig. 8, a 
table format shown in Fig 9, etc. may be adopted. 
[0073] 

As mentioned above, the present invention allows the 
packet transfer information of all the APs under 
management to be collected from one monitor apparatus, and 
the terminal having a connection with the AP to be derived 
in each AP by employing the general-purpose protocol such 
as the SNMP. 
[0074] 

Further, in accordance with the present invention, the 
so-called apparatus can be configured of only one general- 
purpose network appliance, thereby enabling a low cost. 
[Embodiment 3] 
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[0075] 

The embodiment 3 of the present invention will be 
explained. 
[0076] 

In the embodiment 1, there is the case that the 
terminal address recorded in the recorder 1013 is repeated. 
That is, in some cases, information such that one terminal 
has a connection with a plurality of the APs 
simultaneously has been recorded in the recorder 1013. 
This might take place due to a delay in updating the 
packet transfer information by the AP, or to making a 
connection with the different subnet by the terminal. The 
so-called subnet signifies a unit of management of the 
network. In the IP network, the high-ranked bit number to 
be specified by a subnet mask out of the IP address 
signifies an address (network address) of the subnet. So 
as to modify such a repetition of the records, the process 
flow as shown in Fig. 4 or Fig. 6 may be added after the 
step Sll. 

[0077] 

At first, a modification method in the case that the 
identical terminal has been recorded in plural will be 
explained based upon Fig. 4. 
[0078] 

This process is executable in a case where the IP 



address of the AP and the terminal is ascertained, and a 
plurality of the records exist because the terminal made a 
connection to the AP of the different subnet. Further, it 
is assumed that there exist the subnets to which the AP 
and the terminal belong respectively, and the subnet of 
each AP and the subnet of each terminal are pre-registered 
within the monitor apparatus 101. In this embodiment, it 
is assumed that the terminal succeeds in authentication 
for making a connection with only the AP that belongs to 
the subnet identical to its own subnet or corresponds to a 
virtual LAN (also described as a VLAN) , and yet has the 
function of virtually making a connection with the 
terminal's own subnet, and comes into a communicatable 
state. With the AP corresponding to the VLAN, it is 
assumed that information as to which subnet with which the 
above AP can make a virtual connection can be grasped in 
advance . 

[0079] 

In a step S21, for the terminal, which has a 
connection with a plurality of APs according to the record, 
the record of connection with the AP belonging to the 
subnet other than that of the above terminal, and the 
record of the connection with the AP that does not 
correspond to the VLAN connectable to the subnet of the 
terminal are deleted. 
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[0080] 

In an example of Fig. 5, it has been recorded that a 
terminal 2 having the address B, which belongs to the 
subnet 2, has a connection with three APs; however the 

5 subnet of the AP2 is the subnet 1, which differs from the 
subnet 2 of the terminal 2, so a line of the AP2 to the 
terminal 2 is deleted. The API, of which the subnet is the 
subnet 1, is not deleted because it corresponds to the 
VLAN. 

10 [0081] 

In a case where the repeated record disappears by 
deleting the record associated with the AP belonging to 
the different subnet, it can be judged that the AP of 
which the record have been left is a connection AP of the 

15 above terminal, so the process is finished (step S22) . 
[0082] 

In a case where the repeated record still exists, it 
is confirmed whether, out of the recorded APs, the AP 
belonging to the subnet identical to that of the terminal 

20 exists in (step S23) . In a case where no AP belonging to 
the identical subnet exists, that is, all the APs having 
plural records are an AP corresponding to the VLAN 
respectively, the AP is difficult to specify more 
elaborately than this, so the process is finished, or upon 

25 assuming that the terminal has a connection with an 
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arbitrary AP out of the APs having plural records, the 
other record is deleted, and the process is finished (step 
S25) . 

[0083] 

5 In a case where the AP belonging to the subnet 

identical to that of the terminal exists in the step S23, 
the operation proceeds to the step S24, in which it is 
confirmed whether the AP belonging to the subnet identical 
to that of the terminal exists in plural. 

10 [0084] 

In a case where only one AP belonging to the subnet 
identical to that of the terminal exists, it is judged 
that the above terminal has a connection with the above AP, 
and a line of the other AP, with which the above terminal 

15 have a connection according to the record, is deleted 

(step S27). In a case where the AP belonging to the subnet 
identical to that of the terminal exists in plural in the 
step S24, the AP is difficult to specify more elaborately 
than this, so the process is finished, or upon assuming 

20 that the terminal has a connection to an arbitrary AP out 
of the APs having plural records, which belong to the 
identical subnet, the other record is deleted, and the 
process is finished (step S26) . 
[0085] 

25 In an example of Fig. 5, the AP3 belongs to the subnet 
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2 identical to that of the terminal 2, and the API is an 
AP corresponding to the VLAN, so it is determined that the 
terminal 2 belongs to the AP3 . 
[0086] 

5 As mentioned above, in a case where the identical 

terminal has a connection in a plurality of the access 
points according to the record, judging in a priority 
manner that the access point belonging to the subnet 
identical to that of the above terminal is a connection 

10 destination makes it possible to exclude the result that 
the identical terminal belongs to a plurality of the 
access points, which is contradictory. The reason is that 
the terminal can succeed in authentication for making a 
connection with only the AP that belongs to the subnet 

15 identical to its own subnet, or corresponds to a virtual 
LAN (also describes as a VLAN) , and yet includes the 
function of virtually making a connection with the 
terminal's own subnet, and come into a communicatable 
state, and it can be supposed that the connection record 

20 in the different subnet was described at the moment that 

the terminal failed in the connection authentication. In a 
case where the terminal failed in the connection 
authentication, this matter is left in the record of the 
packet transfer in some cases; however the above terminal 
25 has no connection with the above AP because of a failure 
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in the connection authentication. 
[0087] 

Next, a second modification method in the case that 
the identical terminal has been recorded in plural will be 
5 explained based upon Fig. 6. 
[0088] 

This process is executable in a case where information 
associated with the wireless LAN with which the terminal 
is in connection can be acquired from the terminal. In the 

10 wireless LAN, a unique identifier (hereinafter, referred 
to as an AP group identifier) is used for each group that 
is configured of one AP and a terminal having a connection 
with its AP. In the IEEE standard 802.11, its group is 
defined as a BSS (Basic Service Set), and its identifier 

15 as a BSSID (Basic Service Set Identification) . 
[0089] 

In a step S301, the monitor apparatus 101 acquires 
this AP group identifier from the terminal, which has a 
connection with a plurality of the APs according to the 

20 record, by employing the transmission/reception section 
1011. The monitor apparatus 101 grasps the AP group 
identifier of each AP in advance, or acquires and records 
it from each AP by employing the transmission/reception 
section 1011. 

25 [0090] 
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Fig. 7 shows an example having AP group identifiers by 
APs recorded. And, the acquired AP group identifier of the 
terminal is compared with the AP group identifier of a 
plurality of the APs with which the above terminal has a 
5 connection according to the record. The record of the AP 
of which the AP group identifier differs from that of the 
terminal is all deleted. 
[0091] 

As a result, it is determined that the AP of which the 
10 AP group identifier is identical is the AP with which the 
above terminal has a connection. For example, in a 
situation of having been recorded as show in Fig. 7, upon 
assuming that the AP group identifier acquired from the 
terminal 2 is an identifier C, the entries of the APs 
15 except the AP3 having the identical identifier C, out of 

the APs having the above terminal recorded are deleted. As 
a result, it can be judged that the terminal 2 has a 
connection with the AP3 . 
[0092] 

20 As mentioned above, in a case where the identical 

terminal has a connection in a plurality of the access 
points according to the record, acquiring the 
identification information (the AP group identifier) of 
the wireless LAN from the above terminal to compare it 

25 with the identification information of the access point 



makes it possible to exclude the result that the identical 
terminal belongs to a plurality of the access points, 
which is contradictory, and to grasp a more accurate 
connection relation. The reason is that, also in a case 
where information such that the identical terminal has a 
connection with a plurality of the APs has been recorded, 
the AP group identifier acquired from the above terminal 
bears an AP group identifier of one AP at any time because 
the AP group identifier is information peculiar to' each AP. 
[Embodiment 4] 
[0093] 

The monitor apparatus in accordance with the present 
invention, as apparent from the above explanation, can be 
configured with hardware; however it is also possible to 
realize it with a computer program. 
[0094] 

Fig. 10 is a general block configuration diagram of 
the information processing apparatus having the monitor 
apparatus in accordance with the present invention 
implemented. 
[0095] 

The information processing apparatus shown in Fig. 10 
is comprised of a processor 300, a program memory 301, and 
a record medium 302. 
[0096] 
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In the program memory 301, the foregoing analyzer 1012 
and the control program acting for one part of the display 
1014 are filed, and the processor 300 carries out the 
foregoing action based upon this control program. 
5 [0097] 

Further, in the record medium 302, the details to be 
recorded in the recorder 1013 and the managed terminal 
list 1015 are filed. Additionally, a magnetic storage 
medium such as a hard disc can be employed for the record 
10 medium 302. 

[0098] 

As mentioned above, the present invention is 
applicable to an operation/administration system of the 
wireless LAN and a management server. 
15 [0099] 

Additionally, in order to clarify a connection 
relation based upon the packet transfer information, 
applying the present invention to not only the wireless 
LAN but also the wireless network in which the connection 
20 situation of the terminal is difficult to grasp allows the 
connection situation between the wireless base station 
(the AP in the wireless LAN) and the terminal to be 
grasped . 

[0100] 

25 Further, the present invention is also applicable to a 



- 47 - 



network load distribution controller and an unjust-access 
detector that become one part of the operation system. The 
reason is that the present invention makes it possible to 
grasp the number of the terminal that is connected to each 
5 AP, to estimate the network load to each AP at a high 
precision, further, to acquire from each AP information 
associated with the terminal, which has 
transmitted/received the packet, out of the not- 
authenticated terminals, and to keep the record of the 
10 connection. 



